Password Spraying and Credential Stuffing, Explained

The 30-second explanation

Password spraying tries a password like 'Summer2025!' against thousands of accounts at once, staying below the lockout threshold because no single account fails often enough to trip it. Credential stuffing works the other way round: it takes real logins stolen from one breach and tests them, automatically, everywhere else.

How it works

1. 1

   1. Collect

   Usernames are gathered from public formats, or leaked pairs are pulled from a breach dataset.

2. 2

   2. Automate

   Tools quietly try logins at scale, slowly enough to avoid tripping an alarm.

3. 3

   3. Succeed

   A handful of accounts turn out to use a weak or reused password.

4. 4

   4. Use

   The attacker signs in as those users, with no exploit needed at all.

Attackers start with a list of usernames, often built from a company's email format or pulled straight from a previous breach. With spraying, they try a small number of weak, common passwords against every account on the list, then wait a while before trying again, so lockouts never trigger. With stuffing, they skip guessing altogether and feed in real username-and-password pairs lifted from an unrelated breach, betting that some employees reused one. Neither technique exploits a software flaw. Both work purely because a password was weak, predictable, or recycled from somewhere else, and both lose most of their power the moment MFA and unique passwords are in place.

Real-world example

How to spot it

• Failures spread across many accounts

  One source attempting logins against a wide spread of different usernames.

• Logins from unfamiliar places

  A successful sign-in from a new country or a hosting provider nobody recognises.

• A slow, steady drip of attempts

  Login attempts arriving just under the lockout threshold, spaced out over hours.

• Success right after a run of failures

  A pattern that looks a lot more like guessing than like someone forgetting a password.

What to do

1. 1Turn on MFA everywhere it's available, and block the most common passwords outright.
2. 2Alert on many accounts failing from a single source, not only on one account failing repeatedly.
3. 3Push a password manager so nobody has a reason to reuse a password across services.